EC-COUNCIL ECSAv8 Online Practice Questions and Exam Preparation

EC-COUNCIL ECSAv8 Online Questions & Answers

• Question 71:

  Which of the following has an offset field that specifies the length of the header and data?

  A. IP Header
  B. UDP Header
  C. ICMP Header
  D. TCP Header
  A. IP Header

• Question 72:

  The Internet is a giant database where people store some of their most private information on the cloud, trusting that the service provider can keep it all safe. Trojans, Viruses, DoS attacks, website defacement, lost computers, accidental publishing, and more have all been sources of major leaks over the last 15 years.

  

  What is the biggest source of data leaks in organizations today?

  A. Weak passwords and lack of identity management
  B. Insufficient IT security budget
  C. Rogue employees and insider attacks
  D. Vulnerabilities, risks, and threats facing Web sites
  D. Vulnerabilities, risks, and threats facing Web sites

• Question 73:

  What is a difference between host-based intrusion detection systems (HIDS) and network- based intrusion detection systems (NIDS)?

  

  A. NIDS are usually a more expensive solution to implement compared to HIDS.
  B. Attempts to install Trojans or backdoors cannot be monitored by a HIDS whereas NIDS can monitor and stop such intrusion events.
  C. NIDS are standalone hardware appliances that include network intrusion detection capabilities whereas HIDS consist of software agents installed on individual computers within the system.
  D. HIDS requires less administration and training compared to NIDS.
  C. NIDS are standalone hardware appliances that include network intrusion detection capabilities whereas HIDS consist of software agents installed on individual computers within the system.

• Question 74:

  The first and foremost step for a penetration test is information gathering. The main objective of this test is to gather information about the target system which can be used in a malicious manner to gain access to the target systems.

  

  Which of the following information gathering terminologies refers to gathering information through social engineering on-site visits, face-to-face interviews, and direct questionnaires?

  A. Active Information Gathering
  B. Pseudonymous Information Gathering
  C. Anonymous Information Gathering
  D. Open Source or Passive Information Gathering
  A. Active Information Gathering

• Question 75:

  Amazon, an IT based company, conducts a survey on the usage of the Internet. They found that company employees spend most of the time at work surfing the web for their personal use and for inappropriate web site viewing. Management decide to block all such web sites using URL filtering software.

  

  How can employees continue to see the blocked websites?

  A. Using session hijacking
  B. Using proxy servers
  C. Using authentication
  D. Using encryption
  B. Using proxy servers

• Question 76:

  Which of the following external pen testing tests reveals information on price, usernames and passwords, sessions, URL characters, special instructors, encryption used, and web page behaviors?

  

  A. Check for Directory Consistency and Page Naming Syntax of the Web Pages
  B. Examine Server Side Includes (SSI)
  C. Examine Hidden Fields
  D. Examine E-commerce and Payment Gateways Handled by the Web Server
  C. Examine Hidden Fields

• Question 77:

  The amount of data stored in organizational databases has increased rapidly in recent years due to the rapid advancement of information technologies. A high percentage of these data is sensitive, private and critical to the organizations, their clients and partners. Therefore, databases are usually installed behind internal firewalls, protected with intrusion detection mechanisms and accessed only by applications. To access a database, users have to connect to one of these applications and submit queries through them to the database. The threat to databases arises when these applications do not behave properly and construct these queries without sanitizing user inputs first.

  Identify the injection attack represented in the diagram below:

  

  A. Frame Injection Attack
  B. LDAP Injection Attack
  C. XPath Injection Attack
  D. SOAP Injection Attack
  B. LDAP Injection Attack

• Question 78:

  Identify the type of firewall represented in the diagram below: A. Stateful multilayer inspection firewall

  

  B. Application level gateway
  C. Packet filter
  D. Circuit level gateway
  B. Application level gateway

• Question 79:

  Identify the person who will lead the penetration-testing project and be the client point of contact.

  A. Database Penetration Tester
  B. Policy Penetration Tester
  C. Chief Penetration Tester
  D. Application Penetration Tester
  C. Chief Penetration Tester

• Question 80:

  Identify the correct formula for Return on Investment (ROI).

  A. ROI = ((Expected Returns ?Cost of Investment) / Cost of Investment) * 100
  B. ROI = (Expected Returns + Cost of Investment) / Cost of Investment
  C. ROI = (Expected Returns Cost of Investment) / Cost of Investment
  D. ROI = ((Expected Returns + Cost of Investment) / Cost of Investment) * 100
  C. ROI = (Expected Returns Cost of Investment) / Cost of Investment